NetBSD-SoC: Implementing the algorithms described in RFC 6056 in NetBSD
What is it?
The RFC 6056 describes a number of port randomization algorithms used
in avoiding a number of attacks that rely on guessing the sequence of
ports selected for consecutive connections. We implement these
algorithms in NetBSD trying to modify as little as possible the
- the five algorithms described in RFC6056
- a sysctl that selects the global algorithm to be used for all
sockets that do not make an explicit selection
- a socket option that allows choosing one of the algorithms
specifically for the current socket
- two small test program that allow sending a plain packet using
the globally selected algorithm or using the socket option to select
the algorithm (one for IPv4 and one for IPv6)
- full support for IPv4 and IPv6
- documentation in the form of man pages: a new page rfc6056(7) and
additions to sysctl(7) to describe the new syctls
- export the socket option constant to an userspace header (must
decide which one)
Kernel code in netinet and netinet6 that implements RFC6056's port
Mandatory (must-have) components:
- The 5 algorithms presented in RFC 6056.
Optional (would-be-nice) components:
- A complete testing suite in order to check that each algorithm
works as expected.
status: we created the two small programs that test the port
selection algorithms. The kernel code includes numerous lines of code
comprising DPRINTF calls for debugging the behavior of the algorithms.
The test programs test a particularly relevant issue for the RFC
implementation, namely the support for early binding/late connection.
We provided a manpage rfc6056(7) and added relevant information to sysctl(7)
New interfaces created:
- net.inet.udp.rfc6056.available shows the available algorithms
- net.inet.udp.rfc6056.selected selects one of the available algorithms
- net.inet6.udp6.rfc6056.available shows the available algorithms for IPv6
- net.inet6.udp6.rfc6056.selected selects one of the available algorithms for IPv6
Manpages: rfc6056(7) sysctl(7) . Must decide where to document the new socket option.
- UDP_RFC6056ALGO is a socket option at the IPPROTO_UDP level that allows
setting the algorithm for the current socket. It takes a string parameter
describing the name of the chosen algorithm.
| Vlad Balan <$student_email> |
| $Id: index.html,v 1.5 2011/08/26 18:58:37 vladb38 Exp $ |